One feature of Forefront is the ability to pre-authenticate external users before their requests are sent to a published web application. In addition, it is supposed to be able to forward the accepted credentials to the web application (according to technet). How specifically are these credentials passed? Are they in a header? Are they sent with every request, or just the first?